Spring Security: Custom Authentication Provider -

i have developed application spring mvc high user traffic. suppose there least 20,000 concurrent user. have implemented spring security custom authentication provider in 2 ways.
1st 1 :

@override public authentication authenticate(authentication authentication) throws authenticationexception {      string username = authentication.getname();     string password = authentication.getcredentials().tostring();     customuser user = _userdetailservice.loaduserbyusername(username);     if (user == null || !user.getusername().equalsignorecase(username)) {         throw new badcredentialsexception("username not found.");     }     if (!bcrypt.checkpw(password, user.getpassword())) {         throw new badcredentialsexception("wrong password.");     }     collection < ? extends grantedauthority > authorities = user.getauthorities();     return new usernamepasswordauthenticationtoken(user, password, authorities); } 

2nd 1 is:

@override public authentication authenticate(authentication authentication) throws authenticationexception {   try {     authentication auth = super.authenticate(authentication);     //if reach here, means login success, else exception thrown     //reset user_attempts     return auth;    } catch (badcredentialsexception e) {     //invalid login, update user_attempts     throw e;   } } 

now question whice implementation give me faster output?

as pointed out afridi, 1st version daoauthenticationprovider supposed do. discourage re-implementing functionality, since might example introduce new security relevant errors.

if need custom authentication method, there no way around custom authentication method of course. in order measure performance of implementation in general or versus standard implementation, should define test scenario (e.g. 20000 dummy authentications homlis83 suggested) , run program in profiler. how how time spent in authentication method , part takes time.

i think popular java profiler visualvm , depending on ide there might plugin further simplifies use. there lot of tutorials java profiling out there, definitvely way go reliable data performance.

wiki